USN-8990-1: Sprockets vulnerability
Publication date
3 November 2026
Overview
Sprockets would allow unintended access to files over the network.
Releases
Packages
- ruby-sprockets - Rack-based asset packaging system
Details
It was discovered that Sprockets incorrectly handled certain specially
crafted requests when the Sprockets server was used in production. A remote
attacker could possibly use this issue to access files outside of the
application's root directory.
It was discovered that Sprockets incorrectly handled certain specially
crafted requests when the Sprockets server was used in production. A remote
attacker could possibly use this issue to access files outside of the
application's root directory.
Update instructions
After a standard system update you need to restart any applications using Sprockets to make all the necessary changes.
Learn more about how to get the fixes.The problem can be corrected by updating your system to the following package versions:
| Ubuntu Release | Package Version | ||
|---|---|---|---|
| 16.04 LTS xenial | ruby-sprockets – 3.3.0-1ubuntu0.1~esm1 | ||
Reduce your security exposure
Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.